'The disk is full' is easy to detect and surprisingly tedious to actually diagnose without the right tool — df tells you THAT it's full, du tells you WHERE, and find tracks down one specific thing.
3 min read
df (disk free) answers: how full is each mounted filesystem,
overall?du (disk usage) answers: which directories are actually using the
space, and how much?find answers: where is one specific file matching a pattern?Confusing these wastes time — running du on an entire root filesystem
looking for "is the disk full" when df already answers that in one line
is a common way to make a two-second question take five minutes.
$ df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 50G 47G 1.9G 96% /-h means "human-readable" (GB/MB instead of raw byte counts) — worth using
by default, since raw byte counts are hard to read at a glance. A Use%
near 100% is the actual "disk full" signal — and it's checked here, at the
filesystem level, before going any further.
Once you know the disk is full, du narrows down where:
# -h = human-readable
# -d 1 = go only one level deep: one total per item in this directory
$ du -h -d 1 . | sort -rh | head -10
7.0G .
4.2G ./node_modules
1.8G ./.git
890M ./logs
120M ./dist(du -sh * looks like the obvious shortcut, but the * glob skips hidden
entries like .git — which is often exactly where the space went. Naming
the directory and using -d 1 includes them, and the first line, ., is the
directory's own total.)
sort -rh sorts human-readable sizes correctly, largest first — sorting
without -h would incorrectly treat "1.8G" as smaller than "890M" since
it'd compare the strings, not the actual sizes. This pattern — summarize,
then sort by size, then look at the top few — is the standard way to
quickly find what's actually consuming space in a directory tree, one level
at a time, drilling into whichever entry turns out to be the largest.
find searches for files matching specific criteria, rather than
summarizing size:
# Find files larger than 100MB anywhere under the current directory
$ find . -type f -size +100M
# Find files older than 30 days (useful for cleaning up logs)
$ find /var/log -type f -mtime +30
# Find and delete matching files (be careful — this is irreversible)
$ find /tmp -name "*.tmp" -delete"The disk is full" breaking a deployment or crashing a database is a real,
recurring production incident category — and diagnosing it quickly depends
entirely on knowing which of these three tools actually answers the
question in front of you, rather than guessing. df first (is it actually
full, and where), then du (which directory), then find (which specific
files) is the standard, fast path from "something's wrong" to "here's
exactly what to delete or move."
Check your understanding
A quick comprehension check — not tracked, not graded, just for you.
1. What question does `df` answer that `du` doesn't?
2. Why does `du -h -d 1 . | sort -rh` need the `-h` flag on `sort` specifically, not just on `du`?
3. What is `find /var/log -type f -mtime +30` looking for?
Linux & the Command Line